Table of Contents
Advertisement
8 - 36 WiNG 5.7.1 Access Point System Reference Guide
An Excessive Action Event is an event where an action is performed repetitively and continuously. DoS attacks come under
this category. Use the
triggered.
11. Set the following
Name
Enable
Filter Expiration
Client Threshold
Radio Threshold
Use the
Enable All
Events.
12. Select
OK
to save the updates to the to Excessive Actions configuration used by the WIPS policy. Select
the last saved configuration. The WIPS policy can be invoked at any point in the configuration process by selecting
Wireless IPS Policy
13. Select the
MU Anomaly
configuration parameters.
Excessive Actions Events
Excessive Action Event
configurations:
Displays the name of the excessive action event representing a potential threat to the
network. This column lists the event being tracked against the defined thresholds set for
interpreting the event as excessive or permitted.
Displays whether tracking is enabled for each event. Use the drop-down menu to enable/
disable events as required. A green checkmark defines the event as enabled for tracking
against its threshold values. A red "X" defines the event as disabled and not tracked by
the WIPS policy. Each event is disabled by default.
Set the duration an event generating client is filtered. This creates a special ACL entry,
and frames coming from the client are dropped. The default setting is 0 seconds.
This value is applicable across the RF Domain. If a station is detected performing an attack
and is filtered by an access point, the information is passed to the domain controller. The
domain controller then propagates this information to all the access points in the RF
Domain.
Set the client threshold after which the filter is triggered and an event generated.
Set the radio threshold after which an event is recorded to the event history.
button to enable all Excessive Action Events. Use
from the upper, left-hand side, of the access point user interface.
tab. Ensure the
Activate Wireless IPS Policy
table to select and configure the action taken when events are
Disable All
option remains selected to enable the screen's
button to disable all Excessive Action
Reset
to revert to
Activate
Hide quick links:
Advertisement
Table of Contents
